MAL-2026-4535

    Dashboard / Malicious Package / MAL-2026-4535

    MAL-2026-4535

    Published: 21 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in configcat-trello-powerup (npm)

    Details: Source: amazon-inspector (5365489bc7a763096bf4be47f80bd47e4513917d8b37ba2754e33ae11983872b) package.json declares `"preinstall": "node index.js"`, which fires automatically on `npm install`. index.js collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads sensitive system files (/etc/passwd, /etc/hosts) plus package metadata, then HTTPS POSTs the bundle to a hardcoded Burp Collaborator subdomain `hzklpyrf8gdhgtycz16veroqihobc10q.oastify.com`. The package ships no real functionality — empty description, empty author, and a name resembling a plausible internal Trello/ConfigCat integration — fingerprint of a dependency-confusion squat whose only purpose is to beacon installer-side data to the attacker for follow-on targeting.

    References: https://www.npmjs.com/package/configcat-trello-powerup/v/1.0.0

    Affected packages

    Package

    Name: configcat-trello-powerup

    Purl: pkg:npm/configcat-trello-powerup

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0